Malicious
Malicious

21766a7387dab4bddf4c0bef910b0544

PE Executable
|
MD5: 21766a7387dab4bddf4c0bef910b0544
|
Size: 47.1 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
21766a7387dab4bddf4c0bef910b0544
Sha1
9ab0d7f98e515c1f0a7d9e912f8c483d172efd14
Sha256
4891a893cf7c7e91c11c8ffbe54b00e6d0d0b6606a564ef598a8ba082b923847
Sha384
55763fe6aec77dd72dc95a656f447880f19e0e68d176f196ffafcb8f167fb6747439778ed005864c2114f62ccb85ff6a
Sha512
7d5a7e1233af568480706dcbfdc29e8e1f519595836223765d31ef121f2f57be9f3add5b28e7bf68e7b8cbb5103365862302736301fb007663fcf48de31d1a3a
SSDeep
768:2uXYpTMwj/WWUExRImo2qNZpsah/UOPIEzjbMgXDiUoAjdGwNT4O57BDZOpNp:2uXYpTMY22ona3E3bDXeNGdGwNkOrdib
TLSH
DE232A0037E8812BF2BE8B7899F26145467AF2A77603D54E1CC451DB5713FC68A42AFE

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
21766a7387dab4bddf4c0bef910b0544
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

aElQdzRoQ3NYZnlQNUt5eTRyVlptcmNIQXVkZGJHOWk=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAN2xrdVOwvtSIepKvvmsVzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUxMjE4MTMyNDI0WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJjaRa5Hs6nxH+3cdTupHksR+Q48WsyeiUrxZVa/QMltY+1EhSC3nQoTXDwwx5L2OFiDI2dptS9QbjQHOSbQ9Dpfe3NkzdYCJNo9h5sjzrXNHa+sC3S79TnmMoGug9tI4mtEX7/xMKtbXleSTV0Y/C2DYw/sYHEXOpjBHuGQTUibAlCP9RwdoxVr202scd0HaTErk9Bf2tw0kX62iOs5Xt0egd0Mc/Tzli3bSSpG0MNWc58rYdWYZSqBODiWRDSi9bJBSDdac+NNosa2L6KmDrlA1bpEY6dR/EnIn+bNgm8q3nCqoF8Hl5HxssdeB2cl2Aec3KgUaVfwItJH7as07gbW1n7peG3r8DeWucVODHOOK2LUPmNvrrs2KBbMX6qeU70Zswtom8H++7cmlHE1wi5mpgAfBhqgtnuP/NbROPIg3VEcZAAOWAAPe+7XAhESXEgxnKXLMoIOXSX7l+37OtcJB3tJcnSWI/QLYltK1iV8YltRwpNMPC4rdAT2UmOKkpZiuLZcGL+Z6b2KR6Iyar6YGOKh8z+xR08DXxEs0MJ9VktnoP0A5dMnwTUfs18c3kVvozfId86fwdsgMMqRTYvXdsOLyi6NGrYPwRb5pPu33fp+VKwh9n6azfh216ZbRFNY1OBUJOZm4GQks+ygzOCjHkqZLqpecJcSXYI8u9ztAgMBAAGjMjAwMB0GA1UdDgQWBBQpiOlMEUzlCotVDcCWs4U/jF6TbDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAkcW9KcZUqILeoRYgWg6OzvZHSmDtp17uH9+TI4EJpozASN53gwcBcASX15k3s3IaELck93KX/R+B1l6XlFYzfd5POToC8oapL5R+Yb2a5edlyWm22qsc3TI6IoI4yf+0KqY4eYfDplt6/PfW6QWLYEuC13L3teF6jbiApsJB1aUq+vLgN+N3YbpzNKJkPopQTtVvwskLeO6xNeADF3EL5RE7tpKT7AGA4dxEpMB9uRY0Ty+hQwNh8fTaOcdqicNs9c2YP4X6RYE+35iSoIkqPtLb251tAoM/zPkqJwt3GJvJpTDeFcpbpUseEKWh1KSdhD5aYbJC9wgRv8VKmbCocKpUhCgNEJwLqXT2gVxKmkoi/OCmRYKniheku691eUwxJl7/3GjskOiOCIWO+ujT9Ma7OzGhzVcS0u4mxeTnHqi2b1lTIVosqFMcOdSa7csdfeedzx8tJqceHGXC4UTYnZwjdd5Z0cYUPj/y9nc6i67oIezxcqazGnSD/sSaguvSq9f1ej6EE+MQJ+5QLJEguu0YM+SDnSf5Kjm6Htz2nnWtVs8TQGrHz+f/eIrurdYvlY8za1KV1qSjRGLGwbXW1jQdnf3r2ZhF/zHl+/i9munZbX8FNFvu7KgmzrYo5Lz+f7KBk5W4LFMRUQ3eF9zlTxKHVJjIQuCcLw5rfhSnA6A==
ServerSignature

a8BP0E4wToZ3A07VqR9ZWW7nF78OWb8Va9F1SUvxfTQ2mpF2t7YZqrsymPO+O3AVeO6JvqJcVy7hi9x1hg/UtfZOiCKFts0OjVI8/UYPBY5uUXhdSQHBdIGHdRBvazorjIXoXT1rgE/X5yOgvH/q44mwfFYmnoCxOVSJhhqwyS3E1IzOgW1kWaRx9PBHV+cJD+RIsWVT263UTVkrde+ToIydMtl/MJSrr4CixyPRzUb8AncORT2E+pkynIERgtyFY1+v8/F1FHm4/i71laoaosbud4e/erNTRvGlp3GrO8R7KCeXfl/Qaq7JadqQ6iblVF76VAevFaPHOJFu4WoqhZ1/aP0LgqcCgvAvvqMQKSLMbkGfI16455YP/gyEUsG/TV9PcTLrtCF6S1PdJVGTIkLH935r1vLXADCDKggk0TfNzrMQe6KWH5d+XxqwSoHjDjnDIeBNwoAIdLPGpGzq+qDUWbWgj7CqSCwJWwDp1hIkThyvDM6fTEBs1usQanI504NIBIMw59FghKpu5O1LaBt7tAD3WjhBwwwLpy0D9PTEnPiTFckgbx58hK8D/lNdFZCV03s23XCq3U1igwCrUmTEKaJ5AURTtGLkv0jW48/IQ4yMyFElLGA0ikQKGVEIm2tN8xYSGzPWjyByaY1KaXXVHyw4k/Lj
Install

true
BDOS

false
Anti-VM

false
Install File

incep.uk.com,perfectfoodcompany.uk.com,hybrid.uk.com,u888.br.com,www.u888.br.com
Install-Folder

%AppData%
Ports

80,443,8080,8848
Mutex

ChromeRemoteDesktop.exe
Version

0.5.8
Delay

3
Group

CZPzjnddyczl
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Chrome Remote Desktop.exe
Full Name

Chrome Remote Desktop.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Chrome Remote Desktop.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Chrome Remote Desktop
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name

Chrome Remote Desktop.exe
Full Name

Chrome Remote Desktop.exe
EntryPoint

System.Void Client.Program::Main()
Scope Name

Chrome Remote Desktop.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Chrome Remote Desktop
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

120
Main Method

System.Void Client.Program::Main()
Main IL Instruction Count

51
Main IL

ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Artefacts
Name
 Value
Key (AES_256)

aElQdzRoQ3NYZnlQNUt5eTRyVlptcmNIQXVkZGJHOWk=
Ports

80
Ports

443
Ports

8080
Ports

8848
Mutex

ChromeRemoteDesktop.exe
21766a7387dab4bddf4c0bef910b0544 (47.1 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙